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JAN 0 7 2015 

DEPARTMENT OF 
JUDICIAL ADMINISTRATION 



SUPERIOR COURT, KING COUNTY, WASHINGTON 

STATE OF WASHINGTON ) .14" 1205 2- 1 

) ss. NO: 14-908 

COUNTY OF KING ) AFFIDAVIT FOR SEARCH WARRANT 

Special Agent Michael Larson, being first duly sworn on oath, deposes and says: 

On the basis of the following, I believe there is probable cause that Brian Richard 
Farrell has/have committed, is/are committing, and/or are about to commit the below-identified 
crime(s) in King County, and that 

[X] Evidence of the crime(s) of Violation of the Uniformed Controlled Substances 

Act — Possession of Alprazolam (Xanax) with Intent to Deliver (RCW 69.50.401); 
[X] Contraband, the fruits of a crime, or things otherwise crirninally possessed; 
[ ] Weapons or other things by means of which a crime has been committed or reasonably 

appears about to be committed; 
[ ] A person for whose arrest there is probable cause, or who is unlawfully restrained; 

is/are located in, on, at, or about the following described premises, vehicle or person: 

Premises : The property is located at 4238 163rd Avenue SE, in Bellevue, King County, 
Washington (98006). The property is located on the east side of 163 rd Avenue SE just 
south of SE 42nd Place. The property includes a two-story single-family residence and 
an attached garage. The house is tan in color and the exterior is finished with 
horizontal siding on the lower level and vertical siding on the upper level. 
Additionally, there is a small porch/entryway on the west side of the house which is 
partially enclosed with a three- to four-foot-tall brick wall. The front door is light 
brown in color and faces west. The house number is not visible on the exterior of the 
residence. The search should include the entire property, including the garage and 
any other outbuildings. 

Property : The following property is secured in evidence bags and located in an access- 
controlled facility at the Seattle office of the Homeland Security Investigations, in King 
County, Washington. 

1. A gray/black Apple MacBook Air laptop, serial number C02MR0RHFLCF; 

2. A gray Apple iPad, SN DMPNKAQUG5 Wl ; 
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3. A gray/black Apple iPhone 5S, SN 352007066546184; 

4. A gray/black HTC cellphone, SN HTC6525LVW; 

5. A white three-terabyte Apple Airport Time Capsule, SN C86N80KHF9H6; 

6. A gray/black Sony 32-gigabyte thumb drive; 

7. A black SanDisk 16-gigabyte micro SD card; 

8. A black SanDisk two-gigabyte micro SD card; 

9. A white 02 sim card; 

10. A white Libara sim card. 

On the basis of the following, I, Special Agent Michael Larson, believe there is probable cause 
that Brian Richard Farrell has/have committed, is/are committing, and/or are about to commit the 
above-identified crime(s) in King County, and that evidence of that/those crimes us/are in the 
above-identified location(s). 

AFFIANT 

My name is Michael Larson and I have been a law enforcement officer for over 16 years. I am 
currently a Special Agent with the Department of Homeland Security, United States Immigration 
and Customs Enforcement, Homeland Security Investigations; assigned to the Office of the 
Special Agent in Charge, Seattle, Washington. I have been employed as a Special Agent since 
July 2009 and I am currently assigned to the Border Enforcement Security Task Force (BEST). 
BEST Seattle is comprised of members from Homeland Security Investigations; U.S. Customs 
and Border Protection's Office of Field Operation; the U.S. Secret Service; the U.S. Coast Guard 
Investigative Service; the U.S. Postal Inspection Service; the Seattle Police Department; and the 
Port of Seattle Police Department. BEST Seattle investigates smuggling and related crimes and 
combats criminal organizations seeking to exploit vulnerabilities at the Seattle and Tacoma-area 
airports, seaports, and adjacent waterways. 

During my career, I have participated in investigations and search warrants involving theft, 
fraud, money laundering, smuggling, import and export violations, counterfeit goods, crimes 
against persons, and drug trafficking. I am a graduate of the Federal Law Enforcement Training 
Center's Criminal Investigator Training Program in Brunswick, Georgia, as well as the U.S. 
Immigration and Customs Enforcement Special Agent Training Program. During my 
participation in these two programs, I completed over 2,000 hours of basic and specialized law 
enforcement training. 

.Prior to my employment with' Homeland Security Investigations, I worked for the U.S. District 
Court for eleven years as a U.S. Probation Officer and U.S. Probation Officer Assistant in both 
the Western District of Michigan and Western District of Washington. Additionally, I am a 
graduate of Michigan State University in East Lansing, Michigan, where I received Bachelor's 
degrees in International Relations and Crirninal Justice from James Madison College and the 
School of Criminal Justice, respectively. 

Based on my training and experience, I am familiar with the identification of various illegal 
controlled substances, the field-testing of those illegal controlled substances, the propei 
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terminology that is used to identify and make reference to certain illegal controlled substances, 
and techniques for conducting drug trafficking investigations. 

I have conversed with drug users and drug dealers about illegal controlled substances. I have 
verified information received from drug users and drug dealers through independent sources such 
as police reports, other agents and officers, reliable informants, and from evidence gathered 
during searches. Thus, I am familiar with the methods and ways of drug users and dealers. 

I have participated in the service of search warrants and consent searches where illegal controlled 
substances were located. I am familiar with both the appearance and odor of illegal controlled 
substances from enforcement activities, as well as from training classes in which illegal 
controlled substances were introduced to familiarize officers with their physical characteristics. 1 
have also become familiar with how illegal controlled substances are normally packaged for sale. 

Based on my training, experience, participation in narcotics investigations, and my conversations 
with other experienced narcotics investigators, who I am associated with, I know: 

• That individuals involved in the acquisition, transportation, consumption, and sale ot 
illegal controlled substances, commonly keep paraphernalia and supplies for weighing, 
packaging, and consuming their illegal controlled substances. Such paraphernalia 
includes, but is not limited to, razor blades, pipes, scales, cutting and diluting agents, 
packaging materials, and plastic baggies. The aforementioned items are usually 
maintained in a suspect's residence, including outbuildings and vehicles, for ready access 
and concealment from law enforcement detection. 

• That individuals involved in the acquisition, transportation, and sale of illegal controlled 
substances often use cellular telephones, telephonic pagers, telephone answering 
machines, voice mail systems, and even computer generated electronic messaging 
systems (e-mail) to communicate with suppliers, customers, and accomplices. On 
occasion, persons will "code" their messages in-order to transmit information securely 

• and avoid law enforcement detection. For instance, drug dealers often assign "codes" to 
their customers who can then "page" them and enter their coded identity and/or a 
particular coded drug request. Most cellular telephones, telephonic pagers, answering 
machines, voice mail systems, and computers have the capability to store completed 
messages which detectives can retrieve upon seizing a particular item. 

• That individuals involved in the acquisition, transportation, and sale of illegal controlled 
substances are often in possession of dangerous weapons. These weapons may include, 
but are not limited to, firearms, knives, and swords. Said weapons are used to protect and 
secure a drug dealer's property. Such property may include, but is not limited to, illegal 
controlled substances, records, monies, and other assets. The aforementioned weapons 
are usually maintained in a suspect's residence, including outbuildings and vehicles, foi 
ready access. 
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• That individuals involved in the acquisition, transportation, and sale of illegal controlled 
substances, often take, or allow to be taken, photographs and video recordings of 
themselves, their associates, their property, and their illegal controlled substances. The 
aforementioned photographs and video recordings are usually maintained in a suspect's 
residence and vehicles for their enjoyment. 

• That individuals involved in the acquisition, transportation, and sale of illegal controlled 
substances, routinely maintain records regarding their illegal activities. Their records are 
typically related to the ordering, transportation, acquisition, possession, and sale of then 
illegal controlled substances. These records reflect the names, addresses, and telephone 
numbers of their criminal associates, as well as other locations under their control, such 
as additional residences and storage units. Drug dealers almost always keep records of 
their drug transactions and the payments and debts owed to them. These records ar^ 
commonly 



• referred to as pay/owe sheets. Drug dealers maintain these records in books, ledgers, and 
computers or on computer data storage media, note pads, and scrap papers. The 
aforementioned records are usually maintained in a suspect's residence, including 
outbuildings and vehicles, for ready access and concealment from law enforcement 
detection. 

• That individuals involved in the sale and distribution of illegal controlled substances, 
almost always maintain amounts of money, financial instruments, jewelry, and othei 
assets which are proceeds from or intended to be used to facilitate drug transactions. All 
such items, in addition to being evidence of drug trafficking violations, are forfeitable 
under Washington State law. Because of this, drug dealers will attempt to conceal the 
proceeds of drug sales in secure locations within their residence, including outbuildings 
and vehicles, for ready access and concealment from law enforcement detection. 

• That individuals involved in the sale and distribution of illegal controlled substances, 
profit from the sale of these drugs and then attempt to legitimize those profits. I know 
that to accomplish this task, these individuals often utilized false and fictitious business 
records, cashier checks, accounts in foreign and domestic banks, and often transfer to 
third persons or purchase in another person's name, real and personal property. Also, 
since the government's efforts at seizing and forfeiting drug-related assets have been 
widely publicized, individuals involved in the sale and distribution of illegal controlled 
substances often place assets in the name of others to avoid detection and subsequent 
asset seizure. Records of such activity are often located in a person's residence for ready 
access and concealment from law enforcement detection. 

• That individuals involved in the distribution of illegal narcotics often keep locations in 
lieu of or in addition to their own homes in order to store items related to their illegal 
activities, for the intended purpose of keeping these items safe from potential theft and 
hidden from the detection of law enforcement. 
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INVESTIGATION 



Silk Road Background 




Based on reading FBI and HSMaw enforcement documents and on speaking with agents familiar 
with this investigation, I know that SR2 is the successor site to the original Silk Road, which was 
taken down by law enforcement in 2013. SR2 operates in the same manner as Silk Road. SR2 is 
an anonymous underground web site that has an infrastructure similar to well-known online 
marketplaces such as Amazon Marketplace or eBay, allowing sellers and buyers to conduct 
transactions online. However, unlike legitimate websites, the SR2 website is designed to 
facilitate illegal commerce by ensuring absolute anonymity on the part of both buyer and seller. 
SR2 is a platform that facilitates the sale of illicit goods and services, primarily illegal drugs, 
including, but not limited to, MDMA (Ecstasy), LSD, cannabis, hashish, cocaine and heroin. 
SR2 operates as a middleman or escrow account, holding the digital currency during the 
transaction and taking a commission ranging from 8 to 15 percent from the vendor. SR2 vendors 
advertise that they ship to and from countries around the world, including the United States, 
Netherlands, Germany and the United Kingdom. 

Based on my knowledge and the knowledge of other law enforcement agents familiar with this 
investigation, I know that SR2 is not limited to selling controlled substances. Some of the other 
products listed for sale include weapons, fake identification cards, drug paraphernalia, 
counterfeit merchandise, stolen identity/credit cards, malicious software and computer 
equipment consistent with hacking such as password stealers, key loggers and remote access 
tools. SR2 emerged as one the most sophisticated and extensive criminal marketplaces on the 
Internet to date. 

The primary means by which SR2 protects the user's identity is by operating on "The Onion 
Router" (hereinafter "TOR") network, which is a special network of computers distributed 
around the world designed to conceal the true Internet Protocol (hereinafter "IP") addresses of 
the users on the network. Every communication sent through TOR is bounced through numerous 
relays within the network and wrapped in a layer of encryption at each relay, such that the end 
recipient of the communication has no way of tracing the communication back to its true 
originating IP address. TOR also enables web sites to operate on the network in a manner that 
conceals the true IP address of the computer server hosting the website. 

On October 1, 2013, HSI Chicago working in conjunction with the Federal Bureau of 
Investigation (FBI), New York (NY) arrested Ross Ulbricht, Also Known As (AKA) Dread 
Pirate Roberts (DPR), in San Francisco, CA. DPR owned and operated the Silk Road and shortly 
after his arrest and the Silk Road dismantlement, SR2 was created, which also operates on TOR. 
Silk Road operated from approximately February 201 1 up until the listed DPR arrest date. 
Thereafter, SR2 came online, and it offered the same or similar services, in the same or similar 
manner as Silk Road. 

In order to access SR2, a user has to first download TOR, which is available from a web site 
called www.torproject.org, (there are also other versions available). The user then needs to 
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establish a Bitcoin account, which is another means used to anonymize users' identities. SR2 
requires that all transactions be paid for through the use of "Bitcoins," which are a virtually 
untraceable, decentralized, peer-to-peer form of electronic digital currency having no association 
with banks or governments. 

I know that, based on conversations with agents familiar this investigation, a Bitcoin user 
typically purchases Bitcoins from a Bitcoin "exchanger." Currently a user could go to 
www.coinbase.com, a Bitcoin exchanger, open a Bitcoin account and purchase Bitcoins. Once a 
user has his or her Bitcoin account and TOR program, the user can then enter the SR2 Uniform 
Resource Locator (URL), also known as a web address, and sign up for a SR2 account. During 
the SR2 sign up process the user provides their Bitcoin account number to use for their 
transactions. Many users take additional precautions to mask their transactions by tunneling their 
Bitcoin transactions through several other sites before payment or withdrawals are made. Once a 
user has set up his or her Bitcoin account and SR2 user name, the user can navigate through the 
site, which operates much like any other on-line marketplace. Products are advertised with a full 
description and vendors are rated by other users on the site. 

From January 2014 to July 2014, a FBI NY Source of Information (SOI) provided reliable IP 
addresses for TOR and hidden services such as SR2, which included its main marketplace URL 
(silkroad6ownowfk.onion) 3 its vendor URL (vx3w763ohd256iyh.onion), its forum URL 
(silkroad5v7dywlc. onion) and its support interface (uz434sei7arqunp6.onion). The SOI's 
information ultimately led to the identification of SR2 servers, which led to the identification of 
at least another seventeen black markets on TOR. 

The SOI also identified approximately 78 IP addresses that accessed a vendor .onion address. A 
user cannot accidently end up on the vendor site. The site is for vendors only, and access is only 
given to the site by the SR2 administrators/moderators after confirmation of a significant amount 
of successful transactions. If a user visits the vendor URL, he or she is asked for a user name and 
password. Without a user name and password, the vendor web site cannot be viewed. 

Current Investigation f 



On July 30, 2014, Homeland Security Investigations Seattle received information that a user 
associated with IP address 67.182.142.24 accessed the vendor portal of SR2. Records reveal the 
IP address was associated with a Comcast internet account registered to Steve Phelps at 4238 
1 63rd Avenue SE - Bellevue, WA 98006. 

On August 8, 2014, the Washington Department of Licensing reported the following vehicle and 
driver information for that address: 

3 . Registered to Steve Phelps: 

a. 2005 Blue Volkswagen Beetle, WA Plate 221YJR; 

b. 2004 Black Yamaha XVS 1 1 ASC Motorcycle, WA Plate 7B3364; 

c. 1992 Black Honda VT1 100CL Motorcycle, WA Plate 967140. 
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2. Registered to Brian Fatrell: 

a. 2006 WmteMim Cooper, WA Plate ARF0500; 

b. 1992 White BMW 325, WA Plate ANK1380; 

c. 1991 White Chevrolet Camero, WA Plate 871ZJJ. 



Dn August 13, 2014, Homeland Security Investigations initiated surveillance activities on the 
ibove address, further observing the blue Volkswagen Beetle, and the white Chevrolet Camero. 
\t approximately 2:09 p.m., a white male matching the physical description of Steve Phelps was 
)bserved leaving the residence in the blue Volkswagen Beetle. 

On August 25, 2014, Homeland Security Investigations agents initiated surveillance activities on 
1238 163rd Avenue SE, further observing Brian FarrelPs white Mini Cooper. 

On October 10, 2014, Homeland Security Investigations, assisted by a U.S. Postal Inspector, 
/isited several U.S. Post Offices near 4238 163rd Avenue SE, Bellevue, WA 98006. During 
hese visits, postal employees were interviewed and shown photographs of several individuals to 
nclude Steve Phelps and Brian Farrell. While at the Issaquah Branch located at 400 NW Gihnan] 
Boulevard, one employee recognized the photograph of Brian Farrell, stating that he might have 
iome into the post office several times in the past. While at the Crossroads Branch located at 
[5731 NE Eighth Street, another employee stated that he recognized Brian Farrell as someone 
vho may have come into the post office several times in the past. Another employee at the same 
ocation recognized the photograph of Steve Phelps, farther stating he may have dropped off a 
ub of letters for mailing and he drove a blue station wagon. 

Dn October 20, 2014, Homeland Security Investigations initiated surveillance activities on 4238 
1 63rd Avenue SE, Bellevue, WA 98006; further observing two vehicles not previously observed 
it the residence including a Volkswagen Passat station wagon, bearing WA Plate ARX9262, 
•egistered to Margarita Iordach; and a Toyota pickup truck, bearing WA Plate LIFTED, 
registered to Lesley Karen Gregory. At approximately 1:38 p.m., an individual matching Brian 
FarrelPs physical description was observed leaving the residence in his white Mini Cooper. At 
^proximately 2:55 p.m., Brian Farrell was pulled over for speeding by an officer from the Brier 
Police Department. During the vehicle stop, Brian Farrell admitted to the responding officer that 
le was carrying a Glock semi-automatic pistol in his glove box, further advising he possessed a 
mlid concealed carry permit. 

On October 27, 2014, the Washington Employment Security Department reported Brian Farrell 
•vas employed by CompuCom at 1756 1 14th Avenue, Suite 220, Bellevue, WA 98004, where he 
received wages totaling $69,974.01 for the period covering January 1, 2013, through in or about 
June 2014. No employer or wage information was reported for Steve Phelps during that period. 

On December 1, 2014, Brian Farrell departed Seatac International Airport aboard Icelanderair 
Flight 680 to Keflavik International Airport. On December 20, 2014, Brian Farrell departed 
Dublin International Airport aboard Aer Lingus Flight 125 to Chicago O'Hare International 
Airport. Upon arriving in Chicago, Brian Farrell was referred for a secondary inspection where 
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he was contacted by U.S. Customs and Border Protection Officers and Homeland Security 
Investigations Special Agents. 

During the secondary inspection, Brian Farrell was found to be in possession of the,following 
computers, phones, and digital media: an Apple Airport 3 TB Time Capsule, an Apple iPad, an 
Apple Air Laptop, an Apple iPhone 5S cell phone, an HTC cell phone, a 32 GB thumb drive, and 
four memory cards. When questioned regarding the nature of his travel, Brian Farrell explained 
that he was returning to the U.S. after visiting London, Scotland, and Ireland. Brian Farrell 
further explained that he previously worked for Microsoft and the he was fired from this job in 
September 2014. Brian Farrell explained that he purchased the Apple devices after leaving 
Microsoft, further stating he bought the Apple Airport 3TB Time Capsule while overseas. Brian 
Farrell was unable to explain why he was traveling with so many digital devices, further refusing 
to provide investigators with any of his passcodes. Brian Farrell also purchased a $5,000.00 
Omega watch and a $1,000.00 suit while overseas. Brian Farrell reported his roommate to be 
Steve Phelps. During the inspection, Brian Farrell was also found to be in possession of 
prescriptions for Alprazolam and Diazepam. Brian parrell's computers, phones, and digital 
media were subsequently detained for further review, pursuant to the border search authority 
afforded to customs agents and officers. These items were securely forwarded to HSI-Seattle. 

On December 22, 2014, Homeland Security Investigations Special Agents and Task Force 
Officers initiated contact with Brian Farrell and Steve Phelps at 4238 163rd Avenue SE. Upon 
making contact with Brian Farrell and Steve Phelps, agents identified themselves and their 
purpose; both men agreed to voluntary interviews. 

During the interview of Brian Farrell, agents learned that he previously worked for Microsoft as 
a contract employee. Brian Farrell admitted that he was familiar with Silk Road from the news, 
further admitting to visiting the site within the last six months. Brian Farrell advised agents, "I 
deal with bitcoins," further stating Silk Road was the "shady side of bitcoins." Brian Farrell 
denied ever buying or selling drugs on Silk Road, stating that to the best of his knowledge no one 
living with him was involved in buying or selling drugs. Brian Farrell reported his roommate to 
be Steve Phelps, further stating they have a Comcast account which the two men share. 

During the interview of Steve Phelps, agents learned that he was unemployed and currently 
receiving disability benefits related to severe diabetes. Steve Phelps stated that he has rented a 
room at the residence since 2008. During the period that he has lived there, up to four other 
individuals have lived in the lower level of the house. Currently, only Steve Phelps and Brian 
Farrell live at the residence. Steve Phelps explained that Brian Farrell rents the entire lower level 
of the residence; however, the two men share common areas in the house. Steve Phelps stated 
that Brian Farrell is a "computer wizard," and has made a number of upgrades to the computer 
network in the house. Steve Phelps advised that Brian Farrell has a computer server in the 
garage. Steve Phelps stated he learned about Silk Road and the "dark net" from Brian Farrell. 
Steve Phelps further stated that Brian Farrell showed him the Silk Road website which was full 
of drugs for sale. Brian Farrell advised Steve Phelps that he could get "anything" off the 
website. Steve Phelps described Brian Farrell as displaying great "bravado," noting that Brian 
Farrell bragged about being a hacker and being part of a hacking collective called "Anonymous." 
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Steve Phelps described Brian FarrelPs drug use as being "astonishing," further stating he used all 
kinds of medications including Ambien, Valium, Diazepam, and other narcotics. Steve Phelps 
advised that Brian Phelps receives packages on a daily basis from UPS, FedEx, and USPS. 
Steve Phelps stated Brian Farrell "obsessively" tracks his packages online and "babysits" the 
mailbox. Steve Phelps recalled one occasion where he opened a suspicious package addressed to 
Brian Farrell and found it to contain a bag of Xanax pills. When asked about what he did about 
the pills, Steve Phelps stated that he held on to them, further agreeing to surrender them to 
agents. Steve Phelps stated he first spoke to Brian Farrell about Silk Road within the last six to 
eight months. 

On December 23, 2014, Homeland Security Investigations Special Agents met with Steve Phelps 
who signed a Notice of Abandonment and Assent to Forfeiture of Prohibited or Seized 
Merchandise for the Xanax pills. At the time Mr. Phelps signed the notice, he surrendered 107 
Xanax pills to agents. The pills were subsequently seized, counted, and a logged into evidence. 

Technical Foundation Regarding Digital Devices Seized or to Be Seized 

I know from training and experience that people own cellular telephones for the purpose of being 
able to use them wherever they are, and as such carry them virtually constantly, or are nearly 
always within the near vicinity of their cell phones and/or portable devices. Criminals often use 
cellular phones to communicate with accomplices and will sometimes store accomplice's contact 
or identity information in contact lists, speed dial lists, or other areas of the phone. The 
communications can occur in many ways, including through typical cellular phone calls, instant 
messaging, text messages, SMS communications, chat sessions, email and social networking 
websites. I know that criminals use cellular phones to document and share information about 
criminal activities through phone calls, email, text messages, instant messages, SMS 
communications, photographs, videos, notes, and digital or voice memos mat depict discuss, or 
identity crime scenes, contraband, proceeds, victims, accomplices, or other evidence. Some of 
these communications are directed to another person or persons. Others are posted and shared 
more publicly, as happens with chat sessions and social networking websites. Cellular phone 
users can also use their phones for calendar items, web surfing, and obtaining directions to 
locations. A cellular telephone typically stores, without action by the user, evidence of this use 
and activity of the phone in its memory and other onboard or external storage such as SIM card 
or Micro SD card, as well as information, such as call logs, address books, messages sent and 
received, images, audio and video files, personal calendars, documents, as well as IP addresses 
(unique numeric identifiers assigned when a device assesses the internet) and profiles for 
wireless networks to which they have been connected using wired or Wi-Fi connectivity, which 
include location as well as internet activity information (files viewed via the internet are 
typically automatically downloaded onto a computer). These evidentiary records, 
communications, and images can be retrieved from a cellular telephone, and will also often 
indicate the date, time, and physical location at which the activity occurred (cell site data and/or 
GPS coordinates for the phone). As such, a person's use of the phone will reveal where a person 
has been at particular dates and times relevant to the crimes under investigation in this case, a 
person's activity at relevant dates and times, and/or places where a person frequents at which that 
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person is likely to be found for arrest or at which the suspect stored or inadvertently left evidence 
behind. 

Based on my training and experience, I know that cellular telephones can store such information 
for long periods of time, and that the above-reference information can often be retrieved by a 
trained forensic examiner months or even years after the data was stored on the phone, even 
when it has purportedly have been erased or deleted from the phone. Forensic evidence on the 
phone can also establish how the phone was used, by whom, and when, and the purposes for 
which it was used. Whether some data on the phone is evidence may depend on other 
information stored on the phone, and the application of an examiner's knowledge about how a 
cellular telephone behaves. Therefore, contextual information is necessary to understand the 
other evidence that falls within the scope of the warrant. Sometimes it might be possible to find 
data, records, or location information within a cell phone that can be used to corroborate details 
of an alibi. Other categories of exculpatory evidence might also be available that can help 
investigators to rule out an individual as a suspect. 

One form in which evidence of or pertaining to the above-listed crimes might be found is 
digital — stored on a digital device or digital storage media. The terms "digital device" and 
"device" include devices capable of capturing and/or storing digital data, such as computers, 
cameras, personal assistants, iPods, portable media players, tablet computers like iPad, gaming 
consoles, video cameras, DVRs (digital video recorders), web cams or other video capture 
devices, modems, routers, firewalls, wireless access points, printers, cellular telephones, GPS 
navigation devices, etc. Digital data storage media (hereafter "media") include solid state drives 
(SSDs), hard disk drives (HDDs), compact discs, DVDs, Blu-Ray discs, flash media such as 
thumb drives, Secure Digital (SD) cards, Micro Secure Digital (MicroSD) cards, backup drives, 
and the like. Data stored on digital devices and media can be easily transferred from one device 
or storage media to another. 

I know from training and experience and that of my fellow officers that digital devices and media 
can be used for a wide variety of activities in connection with criminal activity; typically retain 
some evidence of all activity taken on or in the device or media; and, as such, are both 
intentional and/or unintentional storage devices that could contain evidence of crime. Digital 
devices and media can contain evidence of planning, preparation, commission of, efforts to 
conceal, and/or to sell or dispose of the proceeds of criminal activity. Examples of tins evidence, 
places, and types of data in which this evidence may be found include: The identity of 
accomplices, victims and others — which can be stored in files such as photographs, address 
books or contact lists, as well as in records of communications with accomplices, victims and 
others through means such as email, instant messaging, social media, Voice Over IP, and 
videoconferencing. Traces, or even the full contents, of these files and communications can 
remain on the digital device or media for indefinite periods of time after the communication 
originally took place, even if the user deleted the communication. Additional examples of 
evidence that may be found in digital devices and media include but are not limited to records 
regarding the loading, creation, modification, storage, deletion, copying, and/or sending of files 
such as documents, images, or recordings pertaining to the criminal activity or items, persons, or 
places of interest; financial transactions such as with financial institutions, businesses, or 
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individuals; purchases and sales of items or services; research through "web surfing;" use of the 
internet for other activities such as gaming; back up storage to a remote location, such as "the 
cloud;" database inquiries; use of social media; access to websites and services that produce 
directions, maps, or overhead imagery. 

Wholly apart from user-generated files and data, digital devices and media typically store, often 
without any conscious action by the user, electronic evidence pertaining to virtually all actions 
taken on the digital device. This includes, for example, information regarding the identity of the 
device user(s) (the actual or assumed identity used by the person or persons using the digital 
device or media (user profile)). (This is analogous to a search for indicia of occupancy or 
dominion and control while executing a search warrant at a residence and can be found in 
numerous locations and formats within the device.) Additional examples of the type of data that 
analysis of digital devices and media can reveal include the date, time, and geographic location 
at which the device or media were used; evidence regarding the purpose of and actual use of the 
device and media; and evidence related to devices that have been connected, via wire or 
wirelessly, to the device being searched, which can include evidence of remote storage, synching 
of devices to one another, uploading or saving data to other devices, pointers to, and/or 
information pertairiing to evidence that was transferred to and/or is stored at other locations such 
as web-based email accounts, network accessible services, social networking websites, and cloud 
storage. Digital device users typically do not erase or delete this evidence, because special 
software is typically required for the task. However, it is technically possible to delete this 
information. The data can be found in numerous locations, and formats. These types of 
information will be important to the forensic examiner's ability to piece together and recognize 
evidence of the above-listed crimes, when it is found in the digital device(s) or digital storage 
media. 

Evidence can also be embedded into unlikely files for the type of evidence, such as a photo 
hidden within a document or vice versa, or files stored on an external device in an effort to 
conceal their existence. Information stored in digital devices and on media can be stored in 
random order; with deceptive file names; can be hidden from normal view; can be encrypted or 
password protected; and can be stored on unusual devices for the type of data, such as routers, 
printers, scanners, game consoles, or other devices that are similarly capable of storing digital 
data. Additionally, a computer router may store information about a user's internet access and 
could reveal unknown connected digital or remote storage devices or capability; a scanner or 
printer may store information that would identify the digital device with which it was used. 
Whether some data on the digital device(s) or media is evidence may depend on other 
information stored on the digital device(s) and media, and the application of an examiner's 
knowledge about how digital device(s) and media behave. A person who has appropriate 
familiarity with how a digital device works, and relevant contextual information from a 
particular device, can draw conclusions about how the devices and media were used, by whom, 
where, and when. This information is sometimes necessary to identify and understand the other 
evidence that falls within the scope of the warrant. Further, in finding evidence of how a digital 
device or media was used, the purpose of its use, who used it, where, and when, it is sometimes 
necessary to establish that a particular thing is not present on the device or media. 
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Based on my training and experience, I know that digital device(s) and digital storage media can 
store the above-referenced information for long periods of time, and that the information can 
often be retrieved by a trained forensic examiner months or even years after the data was stored 
on the digital device(s), even when it purportedly has been erased or deleted from the device(s). 
Deleted data remains accessible to a forensic examiner until the memory space at which it is 
stored is needed for new data. Thus, the ability to retrieve residue of a deleted electronic file 
from a hard drive depends less on when the file was created, downloaded, viewed, or deleted, 
than on a particular user's operating system, storage capacity, and computer habits. A forensic 
examiner can usually retrieve the above referenced evidentiary material from digital devices and 
media. 

Digital device programs frequently require passwords, user names, and/or pass phrases to 
operate. Those may be kept inside a device, or outside the device in some other area known to 
the user. So, in addition to searching a digital device for evidence of the above-listed crime(s), 
investigators will need to search both the premises searched, and the digital device for evidence 
identifying the user(s) of the device and for passwords, user names, and/or pass phrases needed 
to operate the device. Further, due to the wide variety of di gital devices and their operating 
systems, the forensic examiner may also need the following items in order to conduct a thorough 
and accurate search of the devices: computer hardware, software, peripherals, internal or 
external storage devices, power supplies, cables; internet connection and use information; 
security devices; software; manuals; and related material. 

Depending on the quantity of available data storage, search of digital devices and media is 
anticipated to take anywhere between several hours and weeks to complete. A single megabyte 
of storage space is the equivalent of 500 double-spaced pages of text. A single gigabyte of 
storage space (1,000 megabytes) is the equivalent of 500,000 double-spaced pages of text. 
Storage devices capable of storing terabytes of data are now commonplace. Just duplicating 
such a hard drive in a manner that ensures an accurate forensic copy takes a minimum of several 
hours', and can take days, to complete. 

Due to the length of time required to search digital devices and digital storage media; the need to 
ensure that the devices cannot be altered or wiped via a remote command or destructive codes 
that a user may have embedded in the system; the need to ensure the evidence within the devices 
is correctly handled, which often requires use of forensic equipment in a laboratory environment; 
officer safety concerns; and so that law enforcement can release the search location back to its 
occupants much sooner than would otherwise occur, I request authority to remove from the 
search location all digital devices and media that could contain evidence authorized for seizure 
under the warrant for subsequent search pursuant to the terms of the warrant. To further ensure a 
complete and accurate analysis of the digital device(s) and digital storage media, the computer 
examiner may also need to have available all digital device related items such as software, 
hardware, attached devices such as printers, scanners and the like, power supplies, and cables, 
manuals, and instructions. Thus, I seek authority to also remove these items to the police 
department for later search. 

I also request authority to obtain assistance from a technical specialist, to review the digital 
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device(s) and digital media for the best and least . intrusive method of securing digital evidence that 
this warrant authorizes for seizure, and to assist in securing such evidence. 

CONCLUSION 

Based on all the foregoing information, there is probable cause to believe that evidence of the 
above-listed crimes exists at the above-described premises and that there is probable cause to 
search the above identified premises for the following items: 

> Items in whatever form that are fruits, evidence, or that were/are being used in the course 
of preparing to commit, committing, disposing of proceeds or evidence, and/or efforts to 
conceal the above-listed crimes, including; 

■ Alprazolam (Xanax), and any other unlawfully possessed controlled 
substances, products thereof or byproducts therefrom; 

■ packaging materials, equipment, scales, containers, paraphernalia, and any 
other items used in the consumption, distribution or manufacturing of 
controlled substances; 

■ Documents which show the acquisition and distribution of illegal drugs; 

■ Financial documents which show the distribution of proceeds from illegal 
drug transactions; 

■ Literature, books, magazines, and photographs pertaining to controlled 
substances; 

■ Any weapons possessed in violation of Chapter 9.41 RCW; 

■ Monies or assets deemed to be proceeds of illegal drug transactions; 

> Items in whatever form evidencing dorriinion and control of the premises; 

> Evidence of use of devices that are capable of containing evidence of the listed crimes 
between July 30, 2014, and December 31, 2014, to access black-market trading sites 
and/or to communicate with criminal associates or others about or pertaining to the 
above-listed crime(s), via mcoming or outgoing calls, missed calls, chat sessions, instant 
messages, text messages, voice memo, voice mail, SMS communications, internet usage, 
and the like; 

> Other evidence of or pertaining to use of digital device(s) and digital storage media in 
connection with the above-listed crime(s), in whatever form, including storage media, 
peripherals and other items used in conjunction with digital devices or media to further 
commission or concealment of the crime, or which may be found in printed material such 
as documents, images, videos, contact lists, address lists, records or notes of internet 
searches; 

> Infonnation identifying, tending to identify, or relevant to identifying the digital device 
user at the date and time the things described in the warrant were created, edited, 
accessed or deleted; between the above-stated dates; and/or tending to identify the 
possessor of the device at those dates and times, and/or establishing dominion and control 
of the device at those dates and times; 

> Any of the following that are capable of containing evidence, in whatever form, of the 
above-listed crime(s), and of dominion and control over the digital device and media and 
of dominion and control over the physical location searched. These items may be 

SEARCH WARRANT AFFIDAVIT 

Page 13 of 14 

06.04.14 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
U 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 



subsequently searched for said evidence, and for evidence showing ownership and/or 
identifying the users of said equipment: Any and all computer hardware, software, 
peripherals, internal or external storage devices, power supplies, and cables. The 
following may also be searched for and seized to facilitate search of the above-listed 
items: user names, passwords, pass phrases, internet connection and use information, 
security devices, software, manuals and related materials. 

> Other evidence of or pertaining to use of the device in connection with the above-listed 
crime(s), which may be found in call logs, photographs, images, videos, documents, 
contact lists, address lists, internet searches, or other data storage within the device; 

> All information that can be used to calculate the position of the phone between the above- 
listed dates, including location data, cell tower usage, GPS satellite data, and GPS 
coordinates for routes and destination queries between the above-listed dates which is or 
pertain to evidence of the above-listed crime(s); 

> Data, documents, records, images, videos, or other items in whatever form, tending to 
identify the subscriber of the device, the user of the device, and/or the possessor of the 
device, and/or dominion and control of the device between the above-listed dates. 

I certify under penalty of perjury under the laws of the State of Washington that the foregoing is 
true and correct. 

Signed this ffifay of booe^b^r , 20]*+, at j go\tt ^ WA. 




Special Agent Michael J. Larson 
United States Department of Homeland Security 
Immigrations and Customs Enforcement 
Homeland Security Investigations 



Subscribed and sworn to before me this _ day of 




UPERIOR COURT JUDGE 

Issuance of Warrant Approved: 1 F^yzjTh L~*\^d.<^> 

DANIEL T. SATTERBERG 
King County Prosecuting Attorney 

Approved Electronically on December 30, 2014 

By: Jeremy T. Lazowska, WSBA #39272 
Deputy Prosecuting Attorney 
Criminal Division 



1 If affiant is a Federal Agent, issuance of warrant is also requested by the signing King County Prosecuting Attorney. 
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